{"id":35876,"date":"2019-10-31T22:07:21","date_gmt":"2019-10-31T19:07:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej\/"},"modified":"2019-10-31T22:07:21","modified_gmt":"2019-10-31T19:07:21","slug":"v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej","title":{"rendered":"W platformie handlu elektronicznego Magento naprawiono 75 luk bezpiecze\u0144stwa","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Na otwartej platformie do organizacji handlu elektronicznego <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/magento\">Magento<\/a><\/noindex>, kt\u00f3ra zajmuje oko\u0142o <noindex><a rel=\"nofollow\" href=\"https:\/\/pagely.com\/blog\/top-ecommerce-platforms-2018-compared\/\">20%<\/a><\/noindex> rynku system\u00f3w do tworzenia sklep\u00f3w internetowych, <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.ripstech.com\/2019\/magento-rce-via-xss\/\">zidentyfikowano<\/a><\/noindex> luki, kt\u00f3rych kombinacja pozwala na przeprowadzenie ataku w celu wykonania w\u0142asnego kodu na serwerze, uzyskania pe\u0142nej kontroli nad sklepem internetowym oraz zorganizowania przekierowania p\u0142atno\u015bci. Luki te <noindex><a rel=\"nofollow\" href=\"https:\/\/magento.com\/security\/patches\/magento-2.3.2-2.2.9-and-2.1.18-security-update-13\">zosta\u0142y usuni\u0119te<\/a><\/noindex> w wersjach Magento 2.3.2, 2.2.9 i 2.1.18, w kt\u00f3rych \u0142\u0105cznie usuni\u0119to 75 problem\u00f3w zwi\u0105zanych z bezpiecze\u0144stwem.<\/p>\n<p>Jednym z problem\u00f3w pozwala nieautoryzowanemu u\u017cytkownikowi na umieszczenie kodu JavaScript (XSS), kt\u00f3ry mo\u017ce by\u0107 wykonany podczas przegl\u0105dania dziennika anulowanych zakup\u00f3w w interfejsie administratora. Istota luki polega na mo\u017cliwo\u015bci obej\u015bcia operacji czyszczenia tekstu za pomoc\u0105 funkcji escapeHtmlWithLinks() podczas przetwarzania uwagi w formularzu anulowania na ekranie inicjacji transakcji (u\u017cycie tagu &#171;a href=http:\/\/onmouseover=&#8230;&#187; w innym tagu). Problem pojawia si\u0119 przy u\u017cyciu wbudowanego modu\u0142u Authorize.Net, za pomoc\u0105 kt\u00f3rego przyjmowane s\u0105 p\u0142atno\u015bci kart\u0105 kredytow\u0105.<\/p>\n<p>Aby uzyska\u0107 pe\u0142n\u0105 kontrol\u0119 za pomoc\u0105 kodu JavaScript w kontek\u015bcie bie\u017c\u0105cej sesji pracownika sklepu, wykorzystuje si\u0119 drug\u0105 luk\u0119, kt\u00f3ra pozwala na za\u0142adowanie pliku phar pod postaci\u0105 obrazka (<noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49746\">przeprowadzaj\u0105c<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49641\">atak<\/a><\/noindex> &#171;Phar deserialization&#187;). Plik Phar mo\u017ce by\u0107 za\u0142adowany za pomoc\u0105 formularza dodawania obrazk\u00f3w w wbudowanym edytorze WYSIWYG. Uzyskuj\u0105c wykonanie swojego kodu PHP, atakuj\u0105cy mo\u017ce nast\u0119pnie zmieni\u0107 dane p\u0142atno\u015bci lub zorganizowa\u0107 przechwytywanie informacji o kartach kredytowych klient\u00f3w. <\/p>\n<p>Ciekawe, \u017ce informacje o problemie XSS zosta\u0142y przes\u0142ane do programist\u00f3w Magento jeszcze we wrze\u015bniu 2018 roku, po czym pod koniec listopada wydano poprawk\u0119, kt\u00f3ra, jak si\u0119 okaza\u0142o, usuwa tylko jeden z przypadk\u00f3w i jest \u0142atwa do obej\u015bcia. W styczniu dodatkowo zg\u0142oszono mo\u017cliwo\u015b\u0107 za\u0142adowania pliku Phar pod postaci\u0105 obrazu i pokazano, jak po\u0142\u0105czenie dw\u00f3ch luk mo\u017ce by\u0107 wykorzystywane do kompromitacji sklep\u00f3w internetowych. Pod koniec marca w Magento 2.3.1,<br \/>\n2.2.8 i 2.1.17 usuni\u0119to problem z plikami Phar, ale zapomniano o poprawce XSS, cho\u0107 zg\u0142oszenie problemu zosta\u0142o zamkni\u0119te. W kwietniu analiza XSS zosta\u0142a wznowiona i problem zosta\u0142 rozwi\u0105zany w wersjach 2.3.2, 2.2.9 i 2.1.18. <\/p>\n<p>Nale\u017cy zauwa\u017cy\u0107, \u017ce w podanych wydaniach usuni\u0119to r\u00f3wnie\u017c 75 luk w zabezpieczeniach, z kt\u00f3rych 16 ma poziom niebezpiecze\u0144stwa oznaczony jako krytyczny, a 20 problem\u00f3w mo\u017ce prowadzi\u0107 do wykonania kodu PHP lub wstrzykni\u0119cia operacji SQL. Wi\u0119kszo\u015b\u0107 krytycznych problem\u00f3w mo\u017ce by\u0107 zrealizowana tylko przez uwierzytelnionego u\u017cytkownika, ale jak pokazano powy\u017cej, wykonanie uwierzytelnionych operacji nie jest trudne do osi\u0105gni\u0119cia dzi\u0119ki lukom XSS, z kt\u00f3rych w wymienionych wydaniach usuni\u0119to kilkadziesi\u0105t.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>\u0179r\u00f3d\u0142o: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51027\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e 20% \u0440\u044b\u043d\u043a\u0430 \u0441\u0438\u0441\u0442\u0435\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u043c\u0431\u0438\u043d\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0432\u0435\u0440\u0448\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u043e\u043c \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Magento 2.3.2, 2.2.9 \u0438 2.1.18, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 75 \u043f\u0440\u043e\u0431\u043b\u0435\u043c, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35876","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pl\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"pl_PL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 75 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pl\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:07:21+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:07:21+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Na platformie e-commerce Magento naprawiono 75 luk bezpiecze\u0144stwa | ProHoster","description":"Na otwartej platformie do organizacji handlu elektronicznego Magento, kt\u00f3ra zajmuje oko\u0142o","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 75 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043c\u0435\u0440\u0446\u0438\u0438 Magento, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/v-platforme-elektronnoj-kommertsii-magento-ustraneno-75-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:07:21+00:00","article:modified_time":"2019-10-31T19:07:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35876","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 01:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:54:39","updated":"2026-01-22 01:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/35876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=35876"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/35876\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=35876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=35876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=35876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}